Binance says North Korean hackers used a fake job interview to lure a software engineer into installing malware that led to the compromise of its wallet infrastructure and the theft of about $6.34 billion in digital assets. The exchange said the intrusion started in September and that the attack on October 29 used social engineering, malicious software, and compromised internal systems.
The company tied the case to an incident report published today and said it has rebuilt affected systems, replaced compromised devices, and revoked stolen credentials. It also said it is continuing to investigate the breach and has brought in independent security firms to review its findings.
How the intrusion started
Binance said the employee was contacted through a legitimate job-hunting platform by someone posing as a Project Director at a fictitious company. The worker’s profile showed experience at Binance, which made him a valuable target for people trying to breach the exchange. The fake recruiter arranged two interviews, first with someone claiming to be a human resources representative and then with another person claiming to be the company’s CEO.
During the first interview, the fake HR representative held a live video call and shared a social media account with personal photos and videos to build trust. The second interview took place through a popular social chat application, where the employee was told to download a coding assignment from an online code repository.
Malware hidden in the assignment
According to Binance, the repository contained malicious code that compromised the employee’s device when it was run. The company said the malware was a previously unseen custom strain that antivirus software did not detect. Binance said the malware used obfuscation and evasion techniques, including replacing a legitimate development tool component with a malicious version so it could execute commands and communicate with an attacker-controlled external server.
Binance said the malicious script created a replacement executable named pyenv_ in the macOS Homebrew installation directory. It then deleted the legitimate pyenv executable, renamed the malicious file to pyenv, changed its symbolic link, and used it to spawn a Z shell process. That replacement let the attackers run commands from an attacker-controlled server.
Broader access and theft
By October 20, the attackers had used the compromised engineer’s computer and an internal AI tool to compromise two more employees working on Binance’s wallet infrastructure. Binance said they obtained credentials and a container deployment token. On October 29, the hackers used the stolen credentials to deploy a malicious script and gain unauthorized access to Binance’s wallet signing service, which let them transfer billions of dollars in cryptocurrency across multiple blockchains.
The attackers also abused Ethereum’s EIP-7702 authorization mechanism, which let them keep stealing cryptocurrency even after the exchange suspended withdrawals. As of November 3, about $2.85 billion in stolen assets had been frozen or intercepted, and 98% of impacted token assets had been replenished as of October 31.
North Korean job-interview tactics
Binance said fake job interviews that lead to malware installs are a common tactic in North Korean hacking campaigns known as Contagious Interview and Operation Dream Job. Those campaigns use fake job offers and interviews to trick developers and cryptocurrency employees into installing malware. The exchange said it had not linked the employee compromise to either specific campaign, but said the fake recruiter, the multiple interviews, and the malicious coding assignment closely mirror those previously documented North Korean tactics.
In June 2025, cybersecurity firm Socket reported that a Contagious Interview campaign impersonated recruiters on LinkedIn and sent developers coding assignments containing malicious npm packages. Socket said the 35 malicious npm packages installed malware that allowed attackers to steal browser credentials, cryptocurrency wallet data, and other information from infected computers. North Korean Lazarus hackers have also used similar tactics in Operation Dream Job, distributing malware disguised as employment documents to people working in software development and DeFi companies.
Licensed under CC BY-ND 4.0 International